Privacy Policy

Last updated: November 5, 2026

This policy explains, in plain words, what information PortalSync (run by zHeight, “we”) collects, why, and what control you have over it. It covers the website at this address, the PortalSync app and the customer portal.

1. What we collect

Account details: your name, work email, phone number (if added), company and role.
Project information: what you and your team add, such as projects, milestones, tasks, messages, approvals, files, invoices and payment schedules.
Customer details: the names, emails and phone numbers of customers and contractors your company adds to a project, so they can use the customer portal and receive updates.
Demo requests: the name, company, email and phone number you enter in the “Book a demo” form, used only to contact you about a demo.
Technical information: sign-in records, device and browser type, and basic usage statistics, used to keep the service secure and working.

2. Connected Google and Microsoft accounts

Connecting an account is optional. Each person connects their own account through Google's or Microsoft's own sign-in page; we never see that account's password. You can only connect the account of the email you were invited with.

When you connect Gmail and Google Calendar, we access:

your Gmail messages, threads, labels, drafts and attachments, to show them in PortalSync and to let you read, search, send, reply, forward, draft, label, archive and delete them;
your Google Calendar events, calendar list and calendar time zone, to show your calendar and let you create, change, move, cancel and answer meetings (including Google Meet links);
your Google account's email address and name, to confirm it is the account of the email you were invited with.

The Google permissions (OAuth scopes) PortalSync asks for, and why:

Google permission	What it allows	Why PortalSync needs it
`openid`, `email`, `profile`	Your Google account's name and email address	To check that the connected account is the email you were invited with
`https://www.googleapis.com/auth/gmail.modify`	Read, send, label and delete your Gmail messages and drafts	To show your inbox in PortalSync, and to send, reply, forward, draft, label, archive and file emails to projects when you ask
`https://www.googleapis.com/auth/calendar.events`	See and change events in your calendars	To show your meetings and create, change, move, cancel and answer them (with Google Meet links)
`https://www.googleapis.com/auth/calendar.calendarlist.readonly`	See the list of your calendars	To let you choose which calendars to show
`https://www.googleapis.com/auth/calendar.settings.readonly`	See your calendar settings	To show times in your own time zone

When you connect Outlook / Microsoft 365, we access your mailbox and calendar in the same way and for the same purposes. If your company connects Microsoft Teams or SharePoint, project chats and files are kept there for your company.

What we store from these accounts: an encrypted connection key (refresh token), the connected email address, and links you create between an email thread or meeting and a project. We do not store copies of your emails or calendar events; they are read live from your account each time you open them.

3. How we use information

to provide PortalSync: show your projects, mail and meetings, send the messages and invoices you ask us to send, and notify you of updates;
to keep the service secure, for example to block repeated wrong sign-in attempts and investigate misuse;
to fix problems and improve the service, using technical information (never the content of your email);
to read a contract you choose to upload and suggest the project details from it. This uses an AI service provider, which processes the file only for that request and does not use it to train its models. Data from Google or Microsoft accounts is never sent to an AI service.

We do not sell your information, and we do not use it for advertising.

4. Google API data: Limited Use

PortalSync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means data from your Google account:

is used only to provide the email and calendar features you see in PortalSync;
is not transferred to anyone, except as needed to provide those features (for example, sending an email you wrote), for security, or to comply with the law;
is never used for advertising, never sold, and never used to develop, improve or train AI or machine-learning models;
is never used to create images, video or any other content with AI, and never sent to an AI service;
is not read by any person at zHeight, unless you ask us to for support and agree to it, it is needed for security, or the law requires it.

6. Payments

PortalSync shows invoices and payment status. Payments are made through your service provider's own payment link. We do not collect or store card or bank details.

7. How we protect it

All traffic uses HTTPS. Connection keys for Google and Microsoft are stored encrypted.
Each company's data is kept separate, and roles control who can see email, invoices and settings.
Sign-in is protected against repeated guessing, and customer portal access needs a one-time code and a passcode.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell you and the authorities as the law requires.

8. How long we keep it, and deleting it

Disconnecting Google or Microsoft (My Account → Disconnect) deletes the connection key straight away and asks Google to cancel our access. You can also remove access in your Google account at myaccount.google.com/permissions.
Project information is kept while your company uses PortalSync, because your company needs it as a business record. Your company admin can remove people and projects.
To delete your account or ask what we hold about you, email sourabh@zheight.com. We reply within 30 days.

9. Your choices and rights

Depending on where you live, you may have the right to see, correct, export or delete your information, or to object to how we use it. Email us to use these rights. PortalSync is a business tool and is not meant for children under 16.

10. Changes and contact

If we change this policy, we update the date at the top, and tell you in the app if the change is important. Questions: sourabh@zheight.com.